IOC Radar
IPMediumSignal 40/100

64.226.81.139

Location
GermanyGermany
Frankfurt am Main, Hesse
ASN
AS14061
DigitalOcean, LLC
First Seen
Feb 16, 2025
Last Seen
May 21, 2026
Feb 16
First Seen
483d ago
May 21
Last Seen
24d ago
14
Reports
source reports
40%
Confidence
medium
Found in 14 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
40%
Signal Score
40 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

34 techniques

Network Information

CountryDEGermany
RegionFrankfurt am Main, Hesse
ASNAS14061
OrganizationDigitalOcean, LLC

IP Category

⊕
VPN
VPN exit node

Feed Intelligence Summary

14 reports40% confidence
14
Source reports
40%
Confidence score
Category tags
abuseactive scanactive scanningadbhoney honeypotattackbad reputationbotnetbotnet activitybrute forcebrute force attackcommand and controlcommunication protocolcowrie honeypotcredential accesscredential harvestingcredential stuffingcredentialaccessdata exfiltrationdata store exposurededecoy systemdionaea honeypotdistributed attacksemailemailattackeuropeexploit public-facing applicationexploitation activitygermanyhoneytrap honeypothttp scanneridentity & access exploitationimapindicatorinformation gatheringinitial accessinjection activityipphoney honeypotlamplamp exploit attemptslamp exploitation attemptslogin attemptsmailoney honeypotmalicious activitymalicious softwaremalwaremalware behaviourmalware capturenetworknetwork reconnaissancenetwork scanningnetwork securitynetwork service scanningnetwork traffic analysisnorth americapassword attacksphishingphishing attackphishing trappotential malware distributionprocess injectionreconnaissanceresearchedresource hijackingscannersentrypeer botnetservice scansftp attacksmtpsocial engineeringssh attackssh monitoringsurface webt1021t1040t1041t1046t1055t1059t1059.004t1071.001t1078t1078.004t1110t1110.001t1110.002t1110.003t1110.004t1190t1204.002t1486t1496t1499.001t1499.002t1499.003t1565t1566t1566.001t1566.002t1566.003t1566.004t1583t1589t1595t1595.001t1595.002t1595.003tannertcp/80telecommunicationsthreat actorthreat detectionthreat intelligencetor nodeunited statesvoipvoip attackvpnvulnerability scanweb app attackweb traffic

Activity Timeline

1 total obs
May 21May 21

Threat Activity Heatmap

· Peak: 2026-05-21
Less
More
Mon
Wed
Fri
Jun
·
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreMedium Risk
40
SIGNAL
Signal Score
40%
Confidence
14
Reports
First seenFeb 16, 2025
Last seenMay 21, 2026
GeolocationDE
CountryGermany
LocationFrankfurt am Main, Hesse
ASNAS14061
OrgDigitalOcean, LLC
Coords37.7510, -97.8220
VPN

VirusTotal

Not checked

WHOIS

description
2025-02-25T03:07:59.070017089Z Honeypot : Ipphoney : Source: 64.226.81.139 : Port: 631 Query: {'version': '2.1', 'operation': 'Get-Printer-Attributes', 'request_id': '00000001', 'groups': [{'attributes': [{'attribute_value': ['utf-8'], 'attribute_name': 'attributes-charset', 'attribute_type': 'charset'}, {'attribute_value': ['en-us'], 'attribute_name': 'attributes-natural-language', 'attribute_type': 'language'}, {'attribute_value': ['ipp://99.18.26.21:631/ipp'], 'attribute_name': 'printer-uri', 'attribute_type': 'uri'}, {'attribute_value': ['all'], 'attribute_name': 'requested-attributes', 'attribute_type': 'keyword'}], 'group_type': 'Operation-Attributes-Tag'}]} request_method: POST
raw
inetnum: 64.226.56.0 - 64.226.155.255 netname: NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK descr: IPv4 address block not managed by the RIPE NCC remarks: ------------------------------------------------------ remarks: remarks: For registration information, remarks: you can consult the following sources: remarks: remarks: IANA remarks: http://www.iana.org/assignments/ipv4-address-space remarks: http://www.iana.org/assignments/iana-ipv4-special-registry remarks: http://www.iana.org/assignments/ipv4-recovered-address-space remarks: remarks: AFRINIC (Africa) remarks: http://www.afrinic.net/ whois.afrinic.net remarks: remarks: APNIC (Asia Pacific) remarks: http://www.apnic.net/ whois.apnic.net remarks: remarks: ARIN (Northern America) remarks: http://www.arin.net/ whois.arin.net remarks: remarks: LACNIC (Latin America and the Carribean) remarks: http://www.lacnic.net/ whois.lacnic.net remarks: remarks: ------------------------------------------------------ country: EU # Country is really world wide admin-c: IANA1-RIPE tech-c: IANA1-RIPE status: ALLOCATED UNSPECIFIED mnt-by: RIPE-NCC-HM-MNT created: 2021-11-09T15:01:41Z last-modified: 2021-11-09T15:01:41Z source: RIPE role: Internet Assigned Numbers Authority address: see http://www.iana.org. admin-c: IANA1-RIPE tech-c: IANA1-RIPE nic-hdl: IANA1-RIPE remarks: For more information on IANA services remarks: go to IANA web site at http://www.iana.org. mnt-by: RIPE-NCC-MNT created: 1970-01-01T00:00:00Z last-modified: 2001-09-22T09:31:27Z source: RIPE # Filtered
references
https://raw.githubusercontent.com/ahamed-rizvan/IOCs/refs/heads/main/Malicous%20IP%20Address.txt, https://github.com/telekom-security/tpotce

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 1 year ago · Last seen 24 days ago
Appeared in 14 threat reports